CVE-2020-8286
published 2020-12-14CVE-2020-8286: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
4.63%
91.7th percentile
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Affected
44 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | < 10.14.6 | 10.14.6 |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | >= 10.15 < 10.15.7 | 10.15.7 |
| apple | macos | >= 11.0 < 11.3 | 11.3 |
| apple | macos_big_sur | — | — |
| apple | security_update_2021-002_catalina | — | — |
| debian | curl | < curl 7.74.0-1 (bookworm) | curl 7.74.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xh5x-q49r-r9w4: curl 7
ghsa_unreviewed·2022-05-24
CVE-2020-8286 [HIGH] CWE-295 GHSA-xh5x-q49r-r9w4: curl 7
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
OSV
CVE-2020-8286: curl 7
osv·2020-12-14·CVSS 7.5
CVE-2020-8286 [HIGH] CVE-2020-8286: curl 7
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
OSV
curl vulnerabilities
osv·2020-12-09·CVSS 7.5
CVE-2020-8231 [HIGH] curl vulnerabilities
curl vulnerabilities
Marc Aldorasi discovered that curl incorrectly handled the libcurl
CURLOPT_CONNECT_ONLY option. This could result in data being sent to the
wrong destination, possibly exposing sensitive information. This issue only
affected Ubuntu 20.10. (CVE-2020-8231)
Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV
responses. An attacker could possibly use this issue to trick curl into
connecting to an arbitrary IP address and be used to perform port scanner
and other information gathering. (CVE-2020-8284)
It was discovered that curl incorrectly handled FTP wildcard matchins. A
remote attacker could possibly use this issue to cause curl to consume
resources and crash, resulting in a denial of service. (CVE-2020-8285)
It was discovered that curl incorrectly
CISA ICS
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
cisa_ics·2023-12-14
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
ICS Advisory
##
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
Release DateDecember 14, 2023
Alert CodeICSA-23-348-10
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
- Vulnerabilities: Improper Restriction of XML External Entity Reference, Time-of-check Time-of-use (TOCTOU) Race Condition, Command Injection, Miss
CISA ICS
Siemens SINEC INS
cisa_ics·2022-03-10·CVSS 5.9
[MEDIUM] Siemens SINEC INS
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SINEC INS
Last RevisedMarch 10, 2022
Alert CodeICSA-22-069-09
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SINEC INS
- Vulnerability: Using Components with Known Vulnerabilities
## 2. RISK EVALUATION
Successful exploitation of this vulnerability in third-party components could allow an attacker to interfere with the affected product in various ways.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Siemens reports this vulnerability affects the following SINEC INS (Infrastructure Netw
Oracle
Oracle Oracle Communications Applications Risk Matrix: Balances (cURL) — CVE-2020-8286
vendor_oracle·2021-07-15·CVSS 7.5
CVE-2020-8286 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Balances (cURL) — CVE-2020-8286
Oracle Oracle Communications Applications Risk Matrix: Balances (cURL) vulnerability
CVE: CVE-2020-8286
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2021 (JUL 2021)
CISA ICS
Siemens SIMATIC TIM libcurl
cisa_ics·2021-06-29·CVSS 7.5
[HIGH] Siemens SIMATIC TIM libcurl
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SIMATIC TIM libcurl
Last RevisedJune 29, 2021
Alert CodeICSA-21-159-10
## 1. EXECUTIVE SUMMARY
- CVSS v3 7.5
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC TIM libcurl
- Vulnerabilities: Exposure of Sensitive Information to an Unauthorized Actor, Improper Certificate Validation
## 2. RISK EVALUATION
Successful exploitation of these third-party vulnerabilities could allow an attacker to extract sensitive information and pass a revoked certificate as valid.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The followi
Apple
CVE-2020-8286: Security Update 2021-002 Catalina
vendor_apple·2021-04-26·CVSS 7.5
CVE-2020-8286 [HIGH] CVE-2020-8286: Security Update 2021-002 Catalina
Apple Security Update: About the security content of Security Update 2021-002 Catalina
Product: Security Update 2021-002 Catalina
CVE: CVE-2020-8286
Component: CoreText
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: A logic issue was addressed with improved state management.
Apple
CVE-2020-8286: macOS Big Sur 11.3
vendor_apple·2021-04-26·CVSS 7.5
CVE-2020-8286 [HIGH] CVE-2020-8286: macOS Big Sur 11.3
Apple Security Update: About the security content of macOS Big Sur 11.3
Product: macOS Big Sur
Version: 11.3
CVE: CVE-2020-8286
Component: CoreText
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: A logic issue was addressed with improved state management.
Oracle
Oracle Oracle PeopleSoft Risk Matrix: File Processing (cURL) — CVE-2020-8286
vendor_oracle·2021-04-15·CVSS 7.5
CVE-2020-8286 [HIGH] Oracle Oracle PeopleSoft Risk Matrix: File Processing (cURL) — CVE-2020-8286
Oracle Oracle PeopleSoft Risk Matrix: File Processing (cURL) vulnerability
CVE: CVE-2020-8286
CVSS: 7.5
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Ubuntu
curl vulnerabilities
vendor_ubuntu·2020-12-09·CVSS 7.5
CVE-2020-8286 [HIGH] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Marc Aldorasi discovered that curl incorrectly handled the libcurl
CURLOPT_CONNECT_ONLY option. This could result in data being sent to the
wrong destination, possibly exposing sensitive information. This issue only
affected Ubuntu 20.10. (CVE-2020-8231)
Varnavas Papaioannou discovered that curl incorrectly handled FTP PASV
responses. An attacker could possibly use this issue to trick curl into
connecting to an arbitrary IP address and be used to perform port scanner
and other information gathering. (CVE-2020-8284)
It was discovered that curl incorrectly handled FTP wildcard matchins. A
remote attacker could possibly use this issue to cause curl to consume
resources and crash, resulting in a denial of serv
Red Hat
curl: Inferior OCSP verification
vendor_redhat·2020-12-09·CVSS 7.5
CVE-2020-8286 [HIGH] CWE-295 curl: Inferior OCSP verification
curl: Inferior OCSP verification
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Libcurl offers "OCSP stapling" via the CURLOPT_SSL_VERIFYSTATUS option. When set, libcurl verifies the OCSP response that a server responds with as part of the TLS handshake. It then aborts the TLS negotiation if something is wrong with the response. The same feature can be enabled with --cert-status using the curl tool. As part of the OCSP response verification, a client should verify that the response is indeed set out for the correct certificate. This step was not performed by libcurl when built or told to use OpenSSL as TLS backend.
Package: rh-dotnet21-curl (.NET Core 2.1 on Red Hat Enterprise Linux) - Not a
Microsoft
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
vendor_msrc·2020-12-08·CVSS 7.5
CVE-2020-8286 [HIGH] CWE-295 curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
hackerone: hacke
Debian
CVE-2020-8286: curl - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate re...
vendor_debian·2020·CVSS 7.5
CVE-2020-8286 [HIGH] CVE-2020-8286: curl - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate re...
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Scope: local
bookworm: resolved (fixed in 7.74.0-1)
bullseye: resolved (fixed in 7.74.0-1)
forky: resolved (fixed in 7.74.0-1)
sid: resolved (fixed in 7.74.0-1)
trixie: resolved (fixed in 7.74.0-1)
No detection rules found.
No public exploits indexed.
HackerOne
GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)
hackerone·2026-06-05·CVSS 7.5
CVE-2020-8286 [HIGH] GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)
GnuTLS OCSP stapling accepts unrelated SingleResponse (no cert-ID binding)
## Summary
This report describes a **variant** of the publicly disclosed curl vulnerability **CVE-2020-8286** (OCSP stapling verification bypass), found in the **GnuTLS TLS backend** (`lib/vtls/gtls.c`). The original CVE affected the NSS backend; this variant reproduces the same logical class of defect — accepting revocation status from OCSP response entry `singleResponse[0]` without verifying that the entry corresponds to the authenticated server certificate — in the GnuTLS code path. An attacker who controls or can MitM a TLS connection can supply a crafted stapled OCSP response that bypasses revocation checking, allowing a revoked certificate to be accepted.
---
## Vulnerability Details
| Field | Value |
|--
HackerOne
CVE-2020-8286: Inferior OCSP verification
hackerone·2020-12-09·CVSS 7.5
CVE-2020-8286 [HIGH] CVE-2020-8286: Inferior OCSP verification
CVE-2020-8286: Inferior OCSP verification
cURL (in /lib/vtls/openssl.c) does not check that the certificate serial number in the stapled OCSP response matches the serial number of the certificate it is trying to validate (the peer certificate). This results in a passed validity challenge even when connecting to a site that has had its certificate revoked.
An example program showing the vulnerability and a suggested patch are included.
EXAMPLE:
1. Identify a site with a revoked certificate. (https://revoked.grc.com)
2. Obtain a valid OCSP response for a site signed by the same issuer as
the revoked site. (https://www.grc.com). See
https://akshayranganath.github.io/OCSP-Validation-With-Openssl/ for a
how-to. Use the ocsp option 'respout' to obtain the DER encoded OCSP
response.
Certificate
arXiv
Threat Assessment in Machine Learning based Systems
arxiv_fulltext·2022-06-30
Threat Assessment in Machine Learning based Systems
Threat Assessment in Machine Learning based Systems
Lionel Nganyewou Tidjon and Foutse Khomh, Senior Member, IEEE
The authors are with Polytechnique Montréal, Montréal, QC H3C 3A7, Canada.
E-mail: \lionel.tidjon, foutse.khomh\@polymtl.ca
## Abstract
Machine learning is a field of artificial intelligence (AI) that is becoming essential for several critical systems, making it a good target for threat actors. Threat actors exploit different Tactics, Techniques, and Procedures (TTPs) against the confidentiality, integrity, and availability of Machine Learning (ML) systems.
During the ML
cycle, they exploit adversarial TTPs to poison data and fool ML-based systems. In recent years, multiple security practices have been proposed for traditional systems but they are not enough to cope with th
http://seclists.org/fulldisclosure/2021/Apr/50http://seclists.org/fulldisclosure/2021/Apr/51http://seclists.org/fulldisclosure/2021/Apr/54https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://curl.se/docs/CVE-2020-8286.htmlhttps://hackerone.com/reports/1048457https://lists.debian.org/debian-lts-announce/2020/12/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/https://security.gentoo.org/glsa/202012-14https://security.netapp.com/advisory/ntap-20210122-0007/https://support.apple.com/kb/HT212325https://support.apple.com/kb/HT212326https://support.apple.com/kb/HT212327https://www.debian.org/security/2021/dsa-4881https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttp://seclists.org/fulldisclosure/2021/Apr/50http://seclists.org/fulldisclosure/2021/Apr/51http://seclists.org/fulldisclosure/2021/Apr/54https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdfhttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfhttps://curl.se/docs/CVE-2020-8286.htmlhttps://hackerone.com/reports/1048457https://lists.debian.org/debian-lts-announce/2020/12/msg00029.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/https://security.gentoo.org/glsa/202012-14https://security.netapp.com/advisory/ntap-20210122-0007/https://support.apple.com/kb/HT212325https://support.apple.com/kb/HT212326https://support.apple.com/kb/HT212327https://www.debian.org/security/2021/dsa-4881https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://www.oracle.com/security-alerts/cpuapr2022.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-200951.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-389290.htmlhttps://cert-portal.siemens.com/productcert/html/ssa-398330.html
2020-12-14
Published